[bugfix #936] nohotlink_enabled=true by default

prevent thumbnails from remote image sources on domains other than the
current one by default